Installation
Install the 0.2.0 CLI with pipx. VerifyPatch supports Python 3.10-3.14 and emits reports as JSON and Markdown.
verifypatch check --base origin/main --head HEAD
Wrote verifypatch.json
Wrote verifypatch.md
License Apache-2.0. Source and issues live on GitHub.
Benchmarks
Reproducible release evidence for VerifyPatch 0.2.0. This is not a correctness, security, trust, or certification score.
These results describe the tested repositories, commits, environments, and configurations. They are measured examples, not universal runtime or defect-detection guarantees.
- Release commit
- 70d0b8794a3a495ebb199b6d9ba21d99e74cb906
- Benchmark date
- 2026-08-15
Python matrix
| Python | Result |
|---|---|
| 3.10.20 | 210 passed, 1 skipped, 2 deselected |
| 3.11.15 | 210 passed, 1 skipped, 2 deselected |
| 3.12.13 | 210 passed, 1 skipped, 2 deselected |
| 3.13.13 | 210 passed, 1 skipped, 2 deselected |
| 3.14.4 | 210 passed, 1 skipped, 2 deselected |
Real-repository provenance
Complete means analysis finished. It does not mean the patch was proven correct. tomli stayed incomplete because of an empty or ambiguous coverage context. Zero changed executable lines stay n/a, not 0%.
| Repository | Changed lines | PR-untouched | Runtime | Status |
|---|---|---|---|---|
| iniconfig | 8 | 100% | 1.89 s | complete |
| idna | 3 | 100% | 9.23 s | complete |
| tomli-w | 0 | n/a | 2.08 s | complete |
| zipp | 1 | 0% | 1.79 s | complete |
| tomli | 1 | n/a | 1.82 s | incomplete (empty_context) |
| pluggy | 3 | 100% | 2.10 s | complete |
| packaging | 0 | n/a | 11.64 s | complete |
Performance
| Repository | pytest | VerifyPatch | Added | Multiple | Added RSS |
|---|---|---|---|---|---|
| iniconfig | 0.233 s | 0.579 s | 0.346 s | 2.48x | 46.8 MiB |
| pluggy | 0.332 s | 0.869 s | 0.538 s | 2.62x | 48.0 MiB |
| idna | 2.746 s | 8.488 s | 5.742 s | 3.09x | 47.7 MiB |
Packaging
| Artifact | Size | SHA-256 |
|---|---|---|
| verifypatch-0.2.0-py3-none-any.whl | 97,600 bytes | 06642d2afdd4377ce229f0ce07228369def43e49327a786e1798351182ec3357 |
| verifypatch-0.2.0.tar.gz | 108,356 bytes | f2dce540b8aad6e7ffd9d1cc0d84cd780fb54c1549e396b1f97295b664638df1 |
Security
Repository tests, imports, fixtures, and dependencies are potentially untrusted code. VerifyPatch is designed for isolated CI environments with minimal permissions and no secrets exposed to pull-request execution.
What the product does not claim
The core product does not require an AI model. It does not prove correctness, identify who wrote a test, or sandbox the code it executes. Do not run untrusted pull requests on a reusable self-hosted runner unless it is strongly isolated and disposable.
Never put a provider key in the untrusted job
Tests, conftest.py, imports, build hooks, and dependencies can read that job's environment. Optional requirement extraction uses a two-job split.
Trusted job
Allowlisted requirements and docs only
Provider API
Validated requirements artifact
Secret boundary
Untrusted job
Patch + pytest + VerifyPatch
No provider credentials
Recommended CI shape
- Trigger on pull_request, never pull_request_target.
- Use permissions: contents: read.
- Check out enough history to resolve both revisions.
- Avoid secrets in the job that runs repository code.
- Use an ephemeral GitHub-hosted runner and an explicit timeout.
- Upload the JSON and Markdown reports.
Policy
Policy is informational unless the command includes --enforce. Null or incomplete metrics cannot satisfy configured numeric thresholds.